Hackerone vulnerabilities, page 3
470 vulnerabilities
Known vulnerabilities in Hackerone products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 447 products.
CVE-2018-3726crud-file-server_projectcrud-file-server+2
EPSS score1.06%
crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.CVE-2018-3723defaults-deep_projectdefaults-deep+2EPSS score2.00%
defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.CVE-2018-3719debiannode-mixin-deep+4EPSS score2.09%
mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.CVE-2018-3734hackeronestattic node module+2EPSS score1.89%
stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read content of any file with known path.CVE-2018-3720assign-deep_projectassign-deep+2EPSS score1.99%
assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.CVE-2018-3729hackeronelocalhost-now node module+2EPSS score1.99%
localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.CVE-2018-3713hackeroneangular-http-server node module+1EPSS score1.45%
angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.CVE-2018-3732hackeroneresolve-path node module+2EPSS score2.37%
resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.CVE-2018-3758express-cart_projectexpress-cart+2EPSS score27.07%
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.CVE-2018-3733crud-file-server_projectcrud-file-server+2EPSS score2.18%
crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.CVE-2018-3779activesupport_projectactivesupport+2EPSS score6.13%
active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.CVE-2018-3717debiannode-connect+4EPSS score1.31%
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.CVE-2018-3727626_project626+2EPSS score2.01%
626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with known path.CVE-2018-3737debiannode-sshpk+4EPSS score1.71%
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.CVE-2018-3735bracket-template_projectbracket-template+2EPSS score0.81%
bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in templateCVE-2018-3724general-file-server_projectgeneral-file-server+2EPSS score1.74%
general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read content of any file with known path.CVE-2018-3746hackeronepdfinfojs+2EPSS score4.85%
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.CVE-2018-3739chainguardjitsucom-jitsu+4EPSS score1.98%
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).CVE-2015-9242ecstatic_projectecstatic+2EPSS score2.06%
Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.CVE-2015-9239ansi2html_projectansi2html+2EPSS score1.13%
ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.